CVE-2020-2159: OS Command Injection in CryptoMove Plugin
Summary
CVE-2020-2159: OS command injection in CryptoMove Plugin. Affects io.jenkins.plugins:cryptomove versions < 0.1.33. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CryptoMove Plugin is a Maven package (io.jenkins.plugins:cryptomove) used in Jenkins, an open-source automation server. This plugin allows the configuration of an OS command to execute as part of its build step configuration. It is designed to enhance security by providing cryptographic key management and rotation capabilities. However, versions 0.1.33 and earlier of the CryptoMove Plugin are vulnerable to OS command injection.
Vulnerability Detail
The OS command injection vulnerability in the CryptoMove Plugin allows an attacker with Job/Configure permission to execute arbitrary OS commands on the Jenkins controller. By manipulating the build step configuration, an attacker can inject malicious commands that will be executed with the privileges of the OS user account running Jenkins. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the Job/Configure permission to trusted individuals only. This will limit the potential impact of the vulnerability by reducing the number of users who can exploit it. Additionally, it is recommended to monitor the Jenkins controller for any suspicious activities or unexpected command executions.
Conclusion
The OS command injection vulnerability in the CryptoMove Plugin can have severe consequences for the security and integrity of the Jenkins environment. It is crucial to upgrade to a non-vulnerable version of the plugin and review build step configurations to prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:cryptomove →
FAQ
The vulnerability allows an attacker to execute arbitrary OS commands on the Jenkins controller, potentially leading to unauthorized access, data breaches, and compromise of the Jenkins environment.
An attacker with Job/Configure permission in Jenkins can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
